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REMARKS 

The Applicants and the undersigned thank Examiner Colin for his time and 
consideration given during the telephone interview of February 22, 2005. The Applicants 
and the undersigned also thank the Examiner for his careful review of this application. 
Claims 1-20 have been rejected. Upon entry of this amendment and in connection with 
the Request for Continued Examination (RCE) filed with this amendment and in response 
to the Examiner's Interview Summary mailed on February 28, 2005, Claims 1-20 will 
remain pending in this application. 

The independent claims are Claims 1, 8, and 11. Consideration of the present 
application is respectfully requested in light of the RCE, the telephonic interview, the 
above amendments to the application, and in view of the following remarks. 

Summary pf Telephonic I nterview of F^ary 22. 2005 

The Applicants and the undersigned thank the Examiner for his time and 
consideration given during the telephonic interview of February 22, 2005. During this 
telephonic interview, written points provided by the Applicants prior to the interview 
were discussed. 

These written points addressed the following issue: whether the provisional 
application that was filed on September 19, 2000 and that serves as priority for U.S. 
Patent Application Publication No. 2001/0034847, published in the name of Stephen E. 
Gaul (hereinafter, the "Gaul reference") supports the subject matter in the non-provisional 
application that was relied upon by Examiner Colin in his Final Office Action of 
November 23, 2005 to reject the claims. 

To reject the claims of the present application, it was necessary for Examiner 
Colin to rely on the priority date of the Gaul reference. The provisional application that 
serves as the priority document for the Gaul reference must clearly support the subject 
matter relied upon by the Examiner in the published non-provisional application of the 
Gaul reference as set forth by M.P.E.P. § 2136.03 (Critical Reference Date, Subsection 
(III), page 2100-99). 

The Applicants requested the Examiner to withdraw the finality of the Office 
Action of November 23, 2005 pursuant to M.P.E.P. § 706.07(e) Withdrawal of Final 
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Rejection, General, page 700-77, third paragraph because the Applicants believed that the 
subject matter relied upon by the Examiner in the Gaul reference was not folly supported 
by its corresponding provisional application. 

As one example that subject matter relied upon by the Examiner in the Gaul 
reference was not fully supported by its provisional application, the Applicants referred to 
an element of independent Claim 1 that was addressed by the Examiner's Final Office 
Action of November 23, 2004. The element of independent Claim 1 was as follows: 

"generating workstation credentials in response to the 
scanner conducting the vulnerability assessment of the 
workstation." 

The Applicants noted that Examiner Colin's Final Office Action of November 23, 
2004, Page 3, paragraph 3.2, line 10 relies on Page 7, paragraphs 0073-0078 of the Gaul 
reference to reject the claimed element listed above. The Applicants provided the text of 
paragraphs 0073-0078 of the Gaul reference and its corresponding Figures 2 and 3 in 
their written points. 

The Applicants then compared this text and Figures 2 and 3 of the Gaul reference 
to the text and the only two Figures provided in the provisional application that serves as 
priority to the Gaul reference. The Applicants demonstrated how paragraphs [0073- 
0078] and Figures 2 and 3 of the Gaul reference are not supported by the text and the 
only two figures of the provisional application. 

In response to the Applicants' position, the Examiner directed the Applicants* 
representative to page 14 of the provisional application of the Gaul reference. Page 14, 
second paragraph of the provisional application states the following: 

"...The netPredator.com™ service will provide a user with 
a set of applications that scans a company's Internet 
Firewalls, web servers, e-mail servers, DNS servers, access 
routers and other Internet hosts and identifies any known 
security vulnerabilities. The application then provides 
reports of all security vulnerabilities found and supplies 
information on any known fixes to the identified 
vulnerabilities. . 
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Examiner Colin stated that this text of the provisional application clearly supports 
page 9, paragraph [0115] of the Gaul reference. Page 9, paragraph [0115] of the Gaul 
reference states the following: 

"[0115] Once security penetration testing completes, a 
recommendation report revealing the results is 
automatically delivered to the user. This can be delivered 
through email, traditional mail or directly online through a 
secure Internet browser. This report provides the user with 
detailed results of penetration attempts made and any 
vulnerabilities that may exist. Informed decisions can then 
be made for corrective action." 

While page 14, second paragraph of the provisional application may arguably 
support paragraph [0115] of the Gaul reference, the Applicants note that the Examiner's 
Final Office Action of November 23, 2004 refers to paragraphs [0073-0078] and not 
paragraph [0015] of the Gaul reference to reject independent Claim 1. The Applicants 
also believe that page 14, second paragraph of the provisional may not constitute 
enabling prior art. 1 Whether or not page 14, second paragraph of the provisional 
application or the entire document constitutes enabling prior art, the Examiner has used 
the interview to change the grounds of rejection stated in his Final Office Action. 

Though the Applicants do not believe that it is proper for Examiner Colin to rely 
on the interview summary of February 28, 2005 to support or supplement the grounds of 
his Final Rejection of November 23, 2005, they appreciate the Examiner's time and 
consideration given during the telephone interview of February 22, 2005. To advance the 
prosecution of this application, the Applicants have decided to amend the claims of this 
patent application to clearly define over the prior art of record. The Applicants have also 
filed an RCE in connection with this amendment so that the Examiner can conduct an 
update search so that he can give the amended claims his fullest consideration. 



1 The Applicants also note that white page 14. second paragraph of the provisional application may 
correspond to paragraph [01 15] of the Gaul reference, the Applicants raise the issue of whether page 14, 
subparagraph of the provisional application is fully enabled under 35 U.S.C. § 112 first paragraph m 
view of the lack of detail of the provisional compared to the Gaul reference. As noted previously in trus 
paper the provisional application for the Gaul reference only provides two drawings compared to the 
eleven figures (Figures 1-9) of the Gaul reference. Also, the Gaul reference has substannally more text 
than is found in the provisional application. 
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The Applicants and the undersigned request the Examiner to review this interview 
summary and to approve it by writing 'Interview Record OK" along with his initials and 
the date next to this summary in the margin as discussed in MPEP § 713.04, p. 700-202. 

rio^ p ^rtinns under 35 U fi.fl $6 102 & 103 

The Examiner rejected Claims 1-20 under 35 U.S.C 103(a) as being unpatentable 
over U.S. Patent No. 6,397,245 issued in the name of Johnson, II et al. (hereinafter, the 
"Johnson reference") in view of the Gaul reference. 

The Applicants respectfully offer remarks to traverse these pending rejections. 
The Applicants will address each independent claim separately as the Applicants believe 
that each independent claim is separately patentable over the prior art of record. 

Independent Claim 1 

The rejection of Claim 1 is respectfully traversed. It is respectfully submitted that 
the Johnson and Gaul references fail to describe, teach, or suggest the combination of: (1) 
issuing a request for a scanner from a browser operating oh the workstation to a network 
server via a computer network; (2) transmitting the scanner from the network server to 
the workstation via the computer network, (3) the scanner installable within the browser 
and operative to complete a vulnerability assessment of the workstation to identify 
security vulnerabilities of the workstation that can compromise secure operation of the 
workstation on the computer network; (4) generating workstation credentials in response 
to the scanner conducting the vulnerability assessment of the workstation; (5) comparing 
the workstation credentials to a workstation policy; (6) granting access to the network 
server if the workstation credentials are in compliance with the workstation policy; and 
(7) if access to the network server is granted because the workstation credentials are in 
compliance with the workstation policy, issuing a request for credentials associated with 
a user, as recited in amended independent Claim 1. 

The Gaul Reference 

The Gaul reference describes a system that allows Systems Administrators and 
Network Managers to perform Internet security vulnerability assessments from outside of 



-10- 



PAGE 17124 ' RCVDAT 323/2005 3:32:06 PM [Eastern Standard Time] * SVR:USPT0£FXRH/2' DNIS:8729306 ' CSID:404 572 5145 ' DURATION (mm-$s):0M4 



MfiR 23 2005 15:38 FR KING & SPALDING LLP 404 572 5145 TO 5551«05456810500 P. 18/24 



Application Serial No. 09/665,01 8 

an organization's firewall 37. See Gaul reference, page 2, first column, paragraph 0016. 
The system of the Gaul reference allows a system administrator to use an internet 
browser running on a client 36 to access an external Internet-based Network Security 
Vulnerability Testing (NSVT) application 41 and an internal Network Security 
Vulnerability Testing (NSVT) application 38. See Figure 1 of the Gaul reference 
reproduced below. 




With NSVT applications 38> 41 the user running the client 36 can launch security 
testing against any one system or multiple systems. See Figure 1 of the Gaul reference 
reproduced above and page 3, first column, paragraph 003 1. 

The Gaul reference provides security testing or vulnerability testing of its 
computer system elements, but it does not use its security testing or vulnerability testing 
in connection with allowing a computer system element to gain access to a network or 
service. The Gaul reference is only concerned with random testing of its system 
components under control of system administrators and repairing those components if the 

components fail a test. 

Meanwhile, the Applicants 7 invention generates workstation credentials in 
response to a scanner conducting a vulnerability assessment of the workstation; compares 
the workstation credentials to a workstation policy; grants access to the network server if 



-11- 



PAGE 1 8/24 * RCVD AT 3/23/2005 3:32:06 PM [Eastern Standard Time] * SVR:USPT0-EFXRF-1/2 1 DNIS:8729306 ■ CSID:404 572 5145 * DURATION (mm-ss):0M4 



MAR 23 2005 15:38 FR KING & SPALDING LLP 404 572 5145 TO 5551«05456»10500 P. 19/24 



Application Serial No. 09/665,018 

the workstation credentials are in compliance with the workstation policy; if access to the 
network server is granted because the workstation credentials are in compliance with the 
workstation policy, issues a request for credentials associated with a user, as recited in 
amended independent Claim 1. 



The Johnson Reference 

The Examiner admits that the Gaul reference does not provide a teaching of 
Internet based services that are offered under controlled access. To make up for this 
deficiency of the Gaul reference, the Examiner relies upon the Johnson reference. 

The Johnson reference describes diagnosis software 134 on a management server 
1 30 that can be controlled and directed by a system administrator though a user interface 
102 that is part of an Internet Browser. See Figure 7 of the Johnson reference and 
column 8, lines 24-37. 
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FIG, 7 



The diagnosis software (DCOM) 134 can collect information on a managed object 
such as another computer. The managed object may or may not have data control 
software 150 preinstalled. The diagnosis software 134 checks to determine if a managed 
object has the data control software 150. If the managed object does not have the data 
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control software ISO, a diagnostic installer 152 stored on the managed object will make 
sure the data control software 150 is properly installed through a sockets process. See the 
Johnson reference, column 10, lines 2-33. 

With the data control software 150 in communication with the diagnosis software 
134, a system administrator using the interface 102 may check the networking parameters 
1 6 1 and security parameters 1 62 of a managed obj ect 



1 Automated Diagnostics - Microsoft Internet Explorer 



Fjle Edit Vitfiw Settings detect &lear tleip 



161 1. 

1 62 2 - 

16* 3. 

164 4. 



DIAGNOSTIC MENU 



tOfttworfcirtfi - Diagnose failure to find path or namos 
between a use**© client and another machine in the 
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servers end network print device*. 

k TO * Support C*H - Log a Support Call if the 
twisting diagnostic* do not solve the problem. 



[ Local Intranet Zone 



Fig. 2 



The security parameters 162 can include diagnosing "access denied" or other 
security errors between a user's client and another machine in a network. See Figure 2 of 
the Johnson reference reproduced above that illustrates a diagnostic menu provided by 
the diagnosis software 134. Particularly, see item 2 designated by reference numeral 162 
in Figure 2 above in which a human administrator can diagnose security errors between a 
user's client and another machine in the computer network. 

While the Johnson reference provides diagnostic tools illustrated in Figure 2 that 
can be used remotely by an administrator to determine why a particular network user is 
having problems with security or access, the Johnson reference does not provide any 
teaching of the combination of generating workstation credentials in response to the 
scanner conducting the vulnerability assessment of the workstation; comparing the 
workstation credentials to a workstation policy; granting access to the network server if 
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the workstation credentials are in compliance with the workstation policy; and if access to 
the network server is granted because the workstation credentials are in compliance with 
the workstation policy, issuing a request for credentials associated with a user. 

Summary for Indepe ndent Claim 1 

In light of the differences between amended independent Claim 1 and the Johnson 
and Gaul references noted above, one of ordinary skill in the art recognizes that these 
prior art references, alone or in ^combination, cannot anticipate or render obvious the 
recitations as set forth in amended independent Claim 1. Accordingly, reconsideration 
and withdrawal of the rejection of Claim 1 are respectfully requested. 

Independent Claimi? 

The rejection of Claim 8 is respectfully traversed. It is respectfully submitted that 
the Dinh and Hummel references, fail to describe, teach, or suggest the combination of: 
(1) issuing a request for a scanner to a network server from a browser operating on the 
workstation; (2) transmitting the scanner and a workstation policy from the network 
server to the workstation via the computer network, (3) the scanner installable within the 
browser and operative to generate workstation credentials by completing a vulnerability 
assessment of the workstation; (4) comparing the workstation credentials to the 
workstation policy on the workstation to determine whether the workstation should be 
granted access to the software service; (5) granting access to the software service if the 
workstation credentials are in compliance with the workstation policy; and (6) if access to 
the software service is granted because the workstation credentials are in compliance with 
the workstation policy, issuing a request for user authentication, as recited in amended 

independent Claim 8. 

As noted above with respect to independent Claim I, neither the Gaul reference 
nor the Johnson reference provide the general teaching of granting access to a system or 
network for a workstation and then requesting further information about a user of the 
workstation. It follows that these references also do not teach comparing the workstation 
credentials to the workstation policy on the workstation to detenriine whether the 
workstation should be granted access to the software service; granting access to the 
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software service if the workstation credentials arc in compliance wilh the workstation 
policy; and if access to the software service is granted because the workstation credentials 
are in compliance with the workstation policy, issuing a request for user authentication as 
recited in amended independent Claim 8. 

In light of the differences between Claim 8 and the references mentioned above, 
one of ordinary skill in the art recognizes that the Gaul and Johnson references, alone or 
in combination, cannot anticipate or render obvious the recitations as set forth in 
independent Claim 8. Accordingly, reconsideration and withdrawal of this rejection are 
respectfully requested. 

Independent Claim 1 1 

The rejection of Claim 11 is respectfully traversed. It is respectfully submitted 
that the Gaul and Johnson references, fail to describe, teach, or suggest the combination 
of: (1) issuing a request for a scanner to the network server from a browser operating on 
the workstation; (2) transmitting the scanner from the network server to the workstation 
via the computer network, (3) the scanner installable within the browser and operative to 
generate workstation credentials by completing a vulnerability assessment of the 
workstation to identify security vulnerabilities that would compromise the secure 
operation of the workstation on the computer network; (4) transmitting the workstation 
security credentials from the scanner to the network server via the computer network; (5) 
deterrnining at the network server whether the workstation should be granted access to a 
network service of the network based on the workstation credentials; and (6) granting 
access to the network service if the workstation credentials are in compliance with the 
workstation policy; and (7) if access is granted to the network service because the 
workstation credentials are in compliance with the workstation policy, issuing a request 
for information relating to user authentication, as recited in amended independent Claim 
11. 

As noted above with respect to independent Claim 1, neither the Gaul reference 
nor the Johnson reference provide a teaching of granting access to a system or network 
for a workstation and then requesting further information about a user of the workstation. 
It follows that these two references, alone or in combination, also do not teach 
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transmitting a workstation security credentials from a scanner to the network server via 
the computer network; determining at the network server whether the workstation should 
be granted access to a network service of the network based on the workstation 
credentials; granting access to the network service if the workstation credentials are in 
compliance with the workstation policy; and if access is granted to the network service 
because the workstation credentials are in compliance with the workstation policy, 
issuing a request for information relating to user authentication, as recited in amended 

independent Claim 11. 

In light of the differences between amended Claim 11 and the references 
mentioned above, one of ordinary skill in the art recognizes that the prior art references, 
alone or in combination, cannot anticipate or render obvious the recitations as set forth in 
amended independent Claim 11. Accordingly, reconsideration and withdrawal of this 
rejection are respectfully requested. 

Dependent Claims 2-7. 9-10. and 12-20 

The Applicants respectfully submit that the above-identified dependent claims are 
allowable because the independent claims from which they depend are patentable over 
the cited references. 

Dependent Claims 15-20 emphasize the difference between workstation 
credentials and credentials associated with a user. The workstation credentials are used 
to determine if a workstation should be allowed to proceed with authenticating a user. In 
this way, if the workstation credentials indicate that authentication of a user should not be 
allowed to proceed, then the authentication process is terminated before a user presents 
his or her credentials over the computer network. 

The Applicants also respectfully submit that the recitations of all the dependent 
claims are of patentable significance. Accordingly, reconsideration and withdrawal of the 
rejections of the dependent claims are respectfully requested. 

CONCLUSION 

The foregoing is submitted as a full and complete response to the Office Action 
mailed on November 23, 2004. The Applicants and the undersigned thank Examiner 
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Colin for the consideration of these remarks. The Applicants have submitted remarks to 
traverse the rejections of Claims 1-20. The Applicants respectfully submit that the 
present application is in condition for allowance. Such Action is hereby courteously 



If any issues remain that may be resolved by telephone, the Examiner is 



requested to call the undersigned at 404.572.2884. 

Respectfully submitted, 



King & Spalding 
45 th Floor 

191 Peachtree Street, N.E. 
Atlanta, Georgia 30303 
404.572.4600 

K&S Docket: 05456-105007 



solicited. 



Steven^wigmore 
Reg. ifcy40,447 




March 23, 2005 
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